R-66: the box's own address becomes visible (v0.159.0)

Leg A: „Hálózat" card on Beállítások → Rendszer — Helyi cím (LAN),
Hálózati név (only while Megosztás is enabled), Átjáró; live per render,
stored nowhere (S-5), „—" on unavailable.
Leg B: network section in the Debug system dump (interfaces/route/DNS/
lan_address), best-effort per item via the samba-netns door.
Leg C: NetBIOS trap named — Szerver field helper text + a purely lexical
hint on unreachable failures for single-label non-IP names.

Design note: all guest-net reads go through docker exec into the
host-networked felhom-samba container (stacks/guestnet.go, one seam) —
the controller's own netns is the docker bridge, so /proc/net/route etc.
would answer 172.x (the S-2 trap). Red-proofs: A2 gate-drop and C2
lexical-invert both failed as required.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UuFPHmHNrCJj1VhY6QdDMU

CHANGELOG.md

@@ -1,5 +1,46 @@
 ## Changelog
 
+### v0.159.0 — R-66: the box's own address becomes visible (2026-07-22)
+
+No agent coupling; MinAgent unchanged. Controller-only, three XS legs with one theme: **the box
+must be able to tell you where it is.** Origin: the Felhom↔Felhom NAS pairing drill — the serving
+box's IP was findable only as a hint line buried on the OTHER box's Megosztás page, and the add
+form's failure for a NetBIOS name („FELHOM") taught nothing.
+
+**Leg A — „Hálózat" card** on Beállítások → Rendszer (between „Verzió és frissítés" and „Szerver
+memória"): Helyi cím (LAN), Hálózati név (`\\<SMBServerName>`, rendered ONLY while Megosztás is
+enabled — the NetBIOS name exists only while samba runs), Átjáró, and a muted footer asking the
+customer to read the page aloud during remote troubleshooting. Everything is live-computed per
+render and stored nowhere (S-5); an unavailable value renders „—" („nem állapítható meg").
+
+**Leg B — `network` section in the Debug system dump** (`GET /api/debug/dump`): guest interfaces
+(veth*/docker*/br-* plumbing skipped), default route + gateway + source interface, DNS servers
+from the guest's resolv.conf, and the SAME `lan_address` value Leg A shows so a support session
+can cross-check the two. Best-effort per item — a failed read yields that item's error string in
+place, never aborts the dump.
+
+**Leg C — the NetBIOS trap gets named**: helper text under the NAS add form's Szerver field, plus
+one hint line appended to an `unreachable`-class add failure when the submitted server is a
+single-label non-IP name („Tipp: a(z) »FELHOM« Windows-hálózati névnek tűnik…"). The detection is
+purely lexical (`looksLikeFlatNetworkName`: non-empty, no dot, not `net.ParseIP`-able) — no
+NetBIOS/mDNS resolution is attempted anywhere, and the agent's probe/taxonomy is untouched.
+
+**The one design decision worth recording:** the spec sketched the gateway as a `/proc/net/route`
+read, but the controller runs on a docker BRIDGE — every in-process answer (own routes, own
+resolv.conf = 127.0.0.11, `net.Interfaces` = 172.x) is the S-2 wrong-kind-of-true trap that
+already burned the setup wizard. All guest-net reads therefore go through the ONE guest-netns door
+this process has: a docker-exec into the host-networked felhom-samba container
+(`internal/stacks/guestnet.go`, single `guestNetExecFn` seam). Accepted consequence, by S-5's own
+logic: with Megosztás off the door is closed and the card shows „—" rather than a plausible wrong
+172.x answer.
+
+Tests: `guestnet_test.go` (pure parsers pinned: default route, interface merge, resolv.conf;
+fail-quiet contracts; B1 best-effort with a scripted per-argv exec fake) + `network_card_test.go`
+(A1 all rows, A2 name-row absent when sharing off, A3 „—" fallback, per-render freshness counter,
+B1 dump shape with in-place error, C1/C2/C3 hint lexicon). Red-proofs run and recorded in
+REPORT.md: A2 (enabled-gate dropped → `\\FELHOM` rendered while sharing is off → FAIL) and C2
+(lexical check inverted → the hint nags an IP user → FAIL).
+
 ### v0.158.1 — fix: the lifecycle methods broke every app detail page (2026-07-21)
 
 **Defect shipped in v0.158.0 and caught live within the hour. `/apps/<slug>` returned HTTP 500 for